CRITICAL 9.4 NVD

CVE-2026-115731

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

References

https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution

Published: 2026-11-03 · Source: NVD · Feed updated: 2026-11-04

This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-11-03 via NVD.

Risk Timeline

CVE Disclosed2026-11-03 · 0 days ago

Remediation Resources

Official Advisory

portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-co

vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.